ISO 37301 makes substantial changes in international compliance standards
On April 13, 2021, the International Organization for Standardization (ISO) published ISO 37301 – Compliance management systems – Requirements with guidance for use, focusing on the improvement of internal compliance in companies in the private and public sectors and third sector agents.
Based on the principles of good governance, proportionality, transparency and sustainability, the ISO 37301 replaces ISO 19600 of 2014 and makes substantial changes in international compliance standards.
Unlike the previous standard, which set out general guidelines for implementation of compliance management systems, ISO 37301 establishes criteria for establishing, developing, implementing, evaluating, maintaining and improving compliance management systems within organizations.
The new ISO is not restricted to anticorruption compliance, which continues to be covered by ISO 37001 (establishing requirements for prevention, detection and response to situations involving bribery, fraud, money laundering and other corrupt practices). In fact, the new ISO 37301 was structured to allow economic agents to prove their conformity with the law and their organization’s values in a holistic manner – in other words, in a wide variety of areas, such as environmental, regulatory, digital, governance, tax, and employment, depending on the needs of each organization and the scope of its compliance system.
The main objective of the new ISO is thus to enable every enterprise, regardless of its nature, size, or business, to demonstrate in an objective way its commitment to compliance with applicable law through implementation of an effective compliance management system.
To achieve international quality in compliance management, ISO 37301 establishes evaluations and requirements that start with an analysis of the context in which the organization operates and culminate in the structuring of the compliance system, and include identifying the processes, needs, objectives, values, strategies and risks that underlie the organization’s management system and its internal engagement with compliance.
Just like ISO 37001 and ISO 19600, the new ISO is a certifiable standard. In other words, the requirements under the new document will be used to determine if organizations effectively possess (or not) an effective risk management system. In seeking certification, private and public organizations and enterprises will have to show that their compliance management systems meet these new international standards of integrity and conformity with the law.
Along with ISO 37001 and Brazil’s Selo Pró-Ética (the “Pro-Ethics Seal”), ISO 37301 will be one of the principal certifications for companies that wish to demonstrate their commitment to compliance practices to their stakeholders.
*Photo: Christina Morillo/Pexels
